{
  "version": "4.1",
  "eventType": "syslogFields",
  "description": "newRule",
  "uid": "f620724b-7170-43e1-8a8b-55e98cabe658",
  "phase": "sto2",
  "condition": null,
  "actions": [
    {
      "actionType": "copy",
      "from": {
        "regex": "",
        "state": "closed",
        "values": [{ "value": "" }, { "value": "" }],
        "value": "a"
      },
      "target": "event.commonEventHeader.domain",
      "id": "296bcdd0-1d20-11e8-a96d-298fbe0cb0fd"
    }
  ]
}